depends, libevent: update to 2.1.13-stable

depends/packages/libevent.mk

@@ -1,7 +1,7 @@
-$(package)_version=2.1.12-stable
+$(package)_version=2.1.13-stable
 $(package)_download_path=https://github.com/libevent/libevent/releases/download/release-$($(package)_version)/
 $(package)_file_name=$(package)-$($(package)_version).tar.gz
-$(package)_sha256_hash=92e6de1be9ec176428fd2367677e61ceffc2ee1cb119035037a27d346b0403bb
+$(package)_sha256_hash=f7e9383b8c0baa81b687e5b5eecc01beefaf1b19b64151d95ed61647fe7a315c
 $(package)_patches=0001-fix-windows-getaddrinfo.patch
 
 define $(package)_set_vars

src/libevent/CMakeLists.txt

@@ -81,10 +81,10 @@ set(EVENT_ABI_LIBVERSION
 set(EVENT_PACKAGE_VERSION
     "${EVENT_VERSION_MAJOR}.${EVENT_VERSION_MINOR}.${EVENT_VERSION_PATCH}")
 
-set(EVENT_NUMERIC_VERSION 0x02010c00)
+set(EVENT_NUMERIC_VERSION 0x02010d00)
 # equals to VERSION_INFO in Makefile.am
 set(EVENT_ABI_LIBVERSION_CURRENT   7)
-set(EVENT_ABI_LIBVERSION_REVISION  1)
+set(EVENT_ABI_LIBVERSION_REVISION  2)
 set(EVENT_ABI_LIBVERSION_AGE       0)
 
 # equals to RELEASE in Makefile.am

src/libevent/ChangeLog

@@ -1,3 +1,54 @@
+Changes in version 2.1.13-stable (01 July 2026)
+
+ This release contains several security fixes, affecting users of the
+ following modules: evbuffer, bufferevent, evtag, evrpc, evdns, evhttp.
+ If you have a program that uses one of those modules,
+ or if you distribute libevent, you should upgrade.
+
+ Additionally, this release backports some small modernizations to
+ the libevent codebase, to aid in compiling with the compilers
+ released over the last few years.
+
+ Security Fixes (evtag, evrpc):
+ - Fix an out-of-bounds read in decode_tag_internal.
+   (Found by @Brubbish. GHSA-fj29-64w6-73h6)
+ - Fix an integer overflow in evtag_unmarshal_header.
+   (Found by @Brubbish. GHSA-45c6-qx49-89m8)
+
+ Security Fixes (evhttp):
+ - Discard HTTP trailers, to prevent header smuggling attacks.
+   (Found by @sebastianosrt. GHSA-2gmv-p5m7-98p6)
+ - Restrict HTTP header parsing to prevent request smuggling.
+   (Originally reported by @xclow3n; and then by @kodareef5,
+   @nstaller0490, @AsafMeizneer, and @yaotushaozhu.
+   GHSA-q39v-w2g7-gr8j.)
+ - Treat CRLF and %00 more strictly in HTTP headers, to prevent
+   parser mismatch attacks.
+   (Reported by @xclow3n and @AsafMeizner. See GHSA-q39v-w2g7-gr8j,
+   GHSA-jcwh-pvf2-73p2.)
+ - Fix a heap out-of-bound write that could occur when using
+   AF_UNIX sockets and compiling libevent with -DNDEBUG.
+   (Found by @mat-mo. GHSA-cvq5-vrvr-j338)
+
+ Security fixes (evbuffer, bufferevent):
+ - Fixed a dangling pointer in evbuffer_add_reference.
+   (Found by @DarkaMaul. GHSA-c2pj-cg4r-88c8)
+
+ Security fixes (evdns):
+ - Fix an out-of-bounds write in dnsname_to_labels
+   when building a DNS response of 2^16 bytes.
+   (Found by @sectroyer. GHSA-58rx-7448-jw47)
+
+ Security fixes (example code):
+ - Avoid using strcpy() in sample/http-server.c.
+   (Reported by @sectroyer. GHSA-5rgj-2c58-7jrc.)
+
+ Other fixes:
+ - Backport fixes for numerous compiler warnings.
+ - Backport fixes for compilation with openssl 3 and later.
+
+
+
 Changes in version 2.1.12-stable (05 Jul 2020)
 
  This release contains mostly bug fixes (I decided not to port some features

src/libevent/Makefile.am

@@ -38,7 +38,7 @@ RELEASE = -release 2.1
 #
 # Once an RC is out, DO NOT MAKE ANY ABI-BREAKING CHANGES IN THAT SERIES
 # UNLESS YOU REALLY REALLY HAVE TO.
-VERSION_INFO = 7:1:0
+VERSION_INFO = 7:2:0
 
 # History:          RELEASE    VERSION_INFO
 #  2.0.1-alpha --     2.0        1:0:0
@@ -76,6 +76,7 @@ VERSION_INFO = 7:1:0
 #  2.1.10-stable--    2.1        6:4:0 (No ABI change, WRONG)
 #  2.1.11-stable--    2.1        7:0:0 (ABI changed)
 #  2.1.12-stable--    2.1        7:1:0 (No ABI change)
+#  2.1.13-stable--    2.1        7:2:0 (No ABI change)
 
 # ABI version history for this package effectively restarts every time
 # we change RELEASE.  Version 1.4.x had RELEASE of 1.4.

src/libevent/WIN32-Code/nmake/event2/event-config.h

@@ -271,7 +271,7 @@
 /* #undef EVENT__HAVE_WORKING_KQUEUE */
 
 /* Numeric representation of the version */
-#define EVENT__NUMERIC_VERSION 0x02010c00
+#define EVENT__NUMERIC_VERSION 0x02010d00
 
 /* Name of package */
 #define EVENT__PACKAGE "libevent"
@@ -332,7 +332,7 @@
 #define EVENT__TIME_WITH_SYS_TIME 1
 
 /* Version number of package */
-#define EVENT__VERSION "2.1.12-stable"
+#define EVENT__VERSION "2.1.13-stable"
 
 /* Define to `__inline__' or `__inline' if that's what the C compiler
    calls it, or to nothing if 'inline' is not supported under any name.  */

src/libevent/buffer.c

@@ -1038,8 +1038,13 @@ evbuffer_add_buffer_reference(struct evbuffer *outbuf, struct evbuffer *inbuf)
 
 	if (out_total_len == 0) {
 		/* There might be an empty chain at the start of outbuf; free
-		 * it. */
+		 * it.  Reset the chain pointers afterwards so the subsequent
+		 * APPEND_CHAIN_MULTICAST does not dereference the freed chain
+		 * through outbuf->first / last_with_datap. */
 		evbuffer_free_all_chains(outbuf->first);
+		outbuf->first = NULL;
+		outbuf->last = NULL;
+		outbuf->last_with_datap = &outbuf->first;
 	}
 	APPEND_CHAIN_MULTICAST(outbuf, inbuf);
 

src/libevent/bufferevent-internal.h

@@ -34,6 +34,7 @@ extern "C" {
 #include "event2/event_struct.h"
 #include "evconfig-private.h"
 #include "event2/util.h"
+#include "util-internal.h"
 #include "defer-internal.h"
 #include "evthread-internal.h"
 #include "event2/thread.h"
@@ -224,10 +225,10 @@ struct bufferevent_private {
 	 * So we need to save it, just after we connected to remote server, or
 	 * after resolving (to avoid extra dns requests during retrying, since UDP
 	 * is slow) */
-	union {
-		struct sockaddr_in6 in6;
-		struct sockaddr_in in;
-	} conn_address;
+	/* NOTE: it might be nice to use fewer bytes here, but we need to store
+	 * sockaddr_un sometimes in order to make AF_UNIX sockets work as expected
+	 * with http.c. */
+	struct sockaddr_storage conn_address;
 
 	struct evdns_getaddrinfo_request *dns_request;
 };
@@ -449,7 +450,7 @@ void
 bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, evutil_socket_t fd);
 
 EVENT2_EXPORT_SYMBOL
-void
+int
 bufferevent_socket_set_conn_address_(struct bufferevent *bev, struct sockaddr *addr, size_t addrlen);
 
 

src/libevent/bufferevent_openssl.c

@@ -514,7 +514,9 @@ conn_closed(struct bufferevent_openssl *bev_ssl, int when, int errcode, int ret)
 		put_error(bev_ssl, errcode);
 		break;
 	case SSL_ERROR_SSL:
-		/* Protocol error. */
+		/* Protocol error; possibly a dirty shutdown. */
+		if (ret == 0 && SSL_is_init_finished(bev_ssl->ssl) == 0)
+			dirty_shutdown = 1;
 		put_error(bev_ssl, errcode);
 		break;
 	case SSL_ERROR_WANT_X509_LOOKUP:

src/libevent/bufferevent_sock.c

@@ -116,13 +116,17 @@ bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev,
 		getpeername(fd, addr, &len);
 }
 
-void
+int
 bufferevent_socket_set_conn_address_(struct bufferevent *bev,
 	struct sockaddr *addr, size_t addrlen)
 {
 	struct bufferevent_private *bev_p = BEV_UPCAST(bev);
-	EVUTIL_ASSERT(addrlen <= sizeof(bev_p->conn_address));
-	memcpy(&bev_p->conn_address, addr, addrlen);
+	if (addrlen <= sizeof(bev_p->conn_address)) {
+		memcpy(&bev_p->conn_address, addr, addrlen);
+		return 0;
+	} else {
+		return EVUTIL_EAI_FAIL;
+	}
 }
 
 static void
@@ -472,6 +476,11 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai,
 		bufferevent_decref_and_unlock_(bev);
 		return;
 	}
+	if (result == 0) {
+		/* XXX use the other addrinfos? */
+		result = bufferevent_socket_set_conn_address_(
+			bev, ai->ai_addr, (int)ai->ai_addrlen);
+	}
 	if (result != 0) {
 		bev_p->dns_error = result;
 		bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0);
@@ -481,8 +490,6 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai,
 		return;
 	}
 
-	/* XXX use the other addrinfos? */
-	bufferevent_socket_set_conn_address_(bev, ai->ai_addr, (int)ai->ai_addrlen);
 	r = bufferevent_socket_connect(bev, ai->ai_addr, (int)ai->ai_addrlen);
 	if (r < 0)
 		bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0);